The group of gamers formerly known as Blue Tongue Entertainment

Scammers have been using a different, far more focused tactic to try and hack people's accounts on Steam. They will create a new account, and then mimic an existing user's profile, copying their avatar icon, name and profile page. They then send friend invites to all of that user's friends, in the hope that the person's friends will see the familiar name and accept the invite without thinking. They then send a url, usually a fake steamcommunity one that leads to a phishing page.

It's usually pretty easy to tell these people apart, because the account is brand new, owns no games, and has no hours on any of the stats. Also, the scammers sometimes use the same account for several impostor attempts, so if you look at their alias history, you'll see a bunch of aliases that your real friend is unlikely to have ever used.

Anyway, it goes without saying that if anyone sends you any link to a site that requires a login, that you should always be extremely vigilant that the URL is legitimate before logging in via it. If at all possible, verify the link yourself, by manually browsing to it from a known safe page, e.g. your own home profile.